Defining Which Hosts Are Allowed to Connect Using the Host Access Table
Total Page：16
File Type：pdf, Size：1020Kb
Defining Which Hosts Are Allowed to Connect Using the Host Access Table This chapter contains the following sections: • Overview of Defining Which Hosts Are Allowed to Connect, on page 1 • Defining Remote Hosts into Sender Groups, on page 2 • Defining Access Rules for Email Senders Using Mail Flow Policies, on page 7 • Understanding Predefined Sender Groups and Mail Flow Policies, on page 10 • Handling Messages from a Group of Senders in the Same Manner, on page 12 • Working with the Host Access Table Configuration, on page 20 • Using a List of Sender Addresses for Incoming Connection Rules, on page 22 • SenderBase Settings and Mail Flow Policies, on page 22 • Verifying Senders, on page 25 Overview of Defining Which Hosts Are Allowed to Connect For every configured listener, you must define a set of rules that control incoming connections from remote hosts. For example, you can define remote hosts and whether or not they can connect to the listener. AsyncOS allows you to define which hosts are allowed to connect to the listener using the Host Access Table (HAT). The HAT maintains a set of rules that control incoming connections from remote hosts for a listener. Every configured listener has its own HAT. You configure HATs for both public and private listeners. To control incoming connections from remote hosts, you define the following information: • Remote hosts. Define the way in which a remote host attempts to connect to the listener. You group remote host definitions into sender groups . For example, you can define multiple remote hosts in a sender group by IP address and partial hostname. You can also define remote hosts by their SenderBase Reputation score. For more information, see Defining Remote Hosts into Sender Groups, on page 2. • Access rules. You can define whether the defined remote hosts in the sender group are allowed to connect to the listener and under what conditions. You define access rules using mail flow policies . For example, you can define that a particular sender group is allowed to connect to the listener, but only allow a maximum number of messages per connection. For more information, see Defining Access Rules for Email Senders Using Mail Flow Policies, on page 7 Define which hosts are allowed to connect to the listener on the Mail Policies > HAT Overview page. Defining Which Hosts Are Allowed to Connect Using the Host Access Table 1 Defining Which Hosts Are Allowed to Connect Using the Host Access Table Default HAT Entries When a listener receives a TCP connection, it compares the source IP address against the configured sender groups. It evaluates the sender groups in the order listed on the HAT Overview page. When it finds a match, it applies the configured mail flow policy to the connection. If you have configured multiple conditions within a sender group, that sender group is matched if any of the conditions match. When you create a listener, AsyncOS creates predefined sender groups and mail flow polices for the listener. You can edit the predefined sender groups and mail flow policies, and create new sender groups and mail flow policies. For more information, see Understanding Predefined Sender Groups and Mail Flow Policies, on page 10. You can export all information stored in a Host Access Table to a file, and you can import Host Access Table information stored in a file into the appliance for a listener, overriding all configured Host Access Table information. For more information, see Working with the Host Access Table Configuration, on page 20. Related Topics • Default HAT Entries, on page 2 Default HAT Entries By default, the HAT is defined to take different actions depending on the listener type: • Public listeners. The HAT is set to accept email from all hosts. • Private listeners. The HAT is set up to relay email from the host(s) you specify, and reject all other hosts. In the HAT Overview, the default entry is named “ALL.” You can edit the default entry by clicking the mail flow policy for the ALL sender group on the Mail Policies > HAT Overview page. Note By rejecting all hosts other than the ones you specify, the listenerconfig and systemsetup commands prevent you from unintentionally configuring your system as an “open relay.” An open relay (sometimes called an “insecure relay” or a “third party” relay) is an SMTP email server that allows third-party relay of email messages. By processing email that is neither for nor from a local user, an open relay makes it possible for an unscrupulous sender to route large volumes of spam through your gateway. Defining Remote Hosts into Sender Groups You can define the way in which remote hosts attempt to connect to a listener. You group remote host definitions into sender groups. A sender group is a list of remote hosts defined for the purpose of handling email from those senders in the same way. A sender group is a list of senders identified by: • IP address (IPv4 or IPv6) • IP range • Specific host or domain name • SenderBase Reputation Service “organization” classification • SenderBase Reputation Score (SBRS) range (or lack of score) • DNS List query response Defining Which Hosts Are Allowed to Connect Using the Host Access Table 2 Defining Which Hosts Are Allowed to Connect Using the Host Access Table Sender Group Syntax For more information on the list of acceptable addresses in sender groups, see Sender Group Syntax, on page 3. When an SMTP server attempts an SMTP connection with the appliance , the listener evaluates the sender groups in order and assigns the connection to a sender group when it matches any criterion in the sender group, such as SenderBase reputation score, domain, or IP address. Note The system acquires and verifies the validity of the remote host’s IP address by performing a double DNS lookup. This consists of a reverse DNS (PTR) lookup on the IP address of the connecting host, followed by a forward DNS (A) lookup on the results of the PTR lookup. The system then checks that the results of the A lookup match the results of the PTR lookup. If the results do not match, or if an A record does not exist, the system only uses the IP address to match entries in the HAT. Define sender groups on the Mail Policies > HAT Overview page. Related Topics • Sender Group Syntax, on page 3 • Sender Groups Defined by Network Owners, Domains, and IP Addresses, on page 4 • Defining Sender Groups by SenderBase Reputation Score, on page 6 • Sender Groups Defined by Querying DNS Lists, on page 7 Sender Group Syntax Table 1: Defining Remote Hosts in the HAT: Sender Group Syntax Syntax Meaning n:n:n:n:n:n:n:n IPv6 address; does not need to include leading zeroes. n:n:n:n:n:n:n:n-n:n:n:n:n:n:n:n Range of IPv6 addresses; does not need to include leading zeroes. n:n:n-n:n:n:n:n:n n.n.n.n Full (complete) IPv4 Address n.n.n. Partial IPv4 address n.n.n. n.n. n.n. n. n.n.n.n-n. Range of IPv4 addresses n.n.n.n-n. n.n.n-n. n.n-n. n.n-n n-n. n-n Defining Which Hosts Are Allowed to Connect Using the Host Access Table 3 Defining Which Hosts Are Allowed to Connect Using the Host Access Table Sender Groups Defined by Network Owners, Domains, and IP Addresses Syntax Meaning yourhost.example.com A fully-qualified domain name .partialhost Everything within the partialhost domain n/c IPv4 CIDR address block n.n/c n.n.n/c n.n.n.n/c n:n:n:n:n:n:n:n/c IPv6 CIDR address block; does not need to include leading zeroes SBRS[n:n]SBRS[none] SenderBase Reputation Score. For more information, see Defining Sender Groups by SenderBase Reputation Score, on page 6. SBO:n SenderBase Network Owner Identification Number. For more information, see Defining Sender Groups by SenderBase Reputation Score, on page 6. dnslist[dnsserver.domain] DNS List query. For more information, see Sender Groups Defined by Querying DNS Lists, on page 7. ALL Special keyword that matches ALL addresses. This applies only to the ALL sender group, and is always included (but not listed). Sender Groups Defined by Network Owners, Domains, and IP Addresses Since the SMTP protocol has no built-in method for authenticating senders of email, senders of unsolicited bulk email have been successful at employing a number of tactics for hiding their identity. Examples include spoofing the Envelope Sender address on a message, using a forged HELO address, or simply rotating through different domain names. This leaves many mail administrators asking themselves the fundamental question, “Who is sending me all of this email?” To answer this question, the SenderBase Reputation Service has developed a unique hierarchy for aggregating identity-based information based on the IP address of the connecting host — the one thing that is almost impossible for a sender to forge in a message. An IP Address is defined as the IP address of the sending mail host. The appliance supports both Internet Protocol version 4 (IPv4) and version 6 (IPv6) addresses. A Domain is defined as an entity that uses hostnames with a given second-level domain name (for example, yahoo.com), as determined by a reverse (PTR) lookup on the IP address. A Network Owner is defined as an entity (usually a company) that controls a block of IP addresses, as determined based on IP address space assignments from global registries such as ARIN (the American Registry for Internet Numbers) and other sources.